Splunk Search

Regex

uagraw01
Motivator

I want to exclude this event "values='{CARD}hfgjllanabbflvh=='} from the server. Please suggest me regex for this and suggest me the props and transforms for this.

Below the sample event:

' weblogic.server values='{CARD}hfgjllanabbflvh=='}


[Sourcetype]
SHOULD_LINEMERGE = false
TRANSFORMS-mask = one

 

[one]
REGEX =
FORMAT = 
DEST_KEY = 

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @uagraw01 ,

I think you want to filter all event that contains values='{CARD}hfgjllanabbflvh=='}  string. Please try below; 

transforms.conf

[one]
REGEX = values\='{CARD}hfgjllanabbflvh=='}
DEST_KEY = queue
FORMAT = nullQueue

 

If this reply helps you an upvote is appreciated.

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...